From: Stephen Frost <sfrost@snowman.net>
To: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Janes <jeff.janes@gmail.com>
Cc: Thomas Munro <thomas.munro@gmail.com>
Cc: k.yudhveer@gmail.com, pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
Date: Mon, 21 Dec 2020 14:06:08 -0500
Message-ID: <20201221190608.GM27507@tamriel.snowman.net> (raw)
In-Reply-To: <CABUevEzqsLm3QmPqO8k8i8EKy5BxaHFm6oa8A+1EtgmmbBFazA@mail.gmail.com>
References: <16079-29e9c038e1463751@postgresql.org>
<20191028154754.GS6962@tamriel.snowman.net>
<CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
<CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
<20201221005825.GQ16415@tamriel.snowman.net>
<CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
<543836.1608575492@sss.pgh.pa.us>
<20201221183511.GI27507@tamriel.snowman.net>
<544464.1608576242@sss.pgh.pa.us>
<CABUevEzqsLm3QmPqO8k8i8EKy5BxaHFm6oa8A+1EtgmmbBFazA@mail.gmail.com>
Greetings,
* Magnus Hagander (magnus@hagander.net) wrote:
> On Mon, Dec 21, 2020 at 7:44 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > BTW, do we have a client-side setting to insist that passwords not be
> > sent in MD5 hashing either? A person who is paranoid about this would
> > likely want to disable that code path as well.
>
> I don't think we do, and we possibly should. You can require channel
> binding which will require scram which solves the problem, but it does
> so only for scram.
>
> IIRC we've discussed having a parameter that says "allowed
> authentication methods" on the client as well, but I don't believe it
> has been built. But it wouldn't be bad to be able to for example force
> the client to only attempt gssapi auth, regardless of what the server
> asks for, and just fail if it's not there.
The client is able to require a GSS encrypted connection, and a savy
user will realize that they should 'kinit' (or equivilant) locally and
never provide their password explicitly to the psql (or equivilant)
command, but that's certainly less than ideal.
Having a way to explicitly tell libpq what auth methods are acceptable
was discussed previously and does generally seem like a good idea, as
otherwise there's a lot of risk of what are essentially downgrade
attacks.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: sfrost@snowman.net, magnus@hagander.net, tgl@sss.pgh.pa.us, jeff.janes@gmail.com, thomas.munro@gmail.com, pgsql-hackers@postgresql.org
Subject: Re: BUG #16079: Question Regarding the BUG #16064
In-Reply-To: <20201221190608.GM27507@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox